Turning on Display of Account at Welcome Screen

I had turned off the display of an account at the Windows XP welcome screen (see Hiding an Account from the Welcome Screen) and needed to turn it back on temporarily.

I checked the setting of the account from the command line with the reg query command. The account for which I had hidden the account from the welcome screen display was the administrator account in this case.

C:\Documents and Settings\Administrator>reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList" /v Administrator

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList
    Administrator       REG_DWORD       0x0

The value of zero for HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList\Administrator means the account is not shown on the welcome screen.

I turned the display of that account back on with the reg add command.

C:\Documents and Settings\Administrator>reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\SpecialAccounts\UserList" /v Administrator /t REG_DWORD /d 1
Value Administrator exists, overwrite(Y/N)? y

The operation completed successfully

I had to reboot for the administrator account to be displayed with the other accounts on the system at the welcome screen. The picture chosen for the administrator account was then shown with those for the other accounts, allowing one to click on it to logon.

[/os/windows/xp] permanent link

Rdesktop on Solaris 10

I wanted to be able to use rdesktop, which is an open source client for Windows NT Terminal Server and Windows 2000/2003 Terminal Services, on an Intel-architecture Solaris 10 system, so I downloaded the x86 Solaris 10 version of rdesktop from Sunfreeware.com.

rdesktop-1.5.0-sol10-x86-local.gz Rdesktop is a client for Windows terminal servers - installs in /usr/local. You will also need to install libiconv, openssl-0.9.8f, and to obtain /usr/local/lib/libgcc_s.so.1 you will need to have installed libgcc-3.4.6 or gcc-3.4.6 or higher.

Since one of the requirements for rdesktop 1.5.0 was libiconv , I installed it. I checked the version of gcc on the system. It was 3.4.3.

# /usr/sfw/bin/gcc -v
Reading specs from /usr/sfw/lib/gcc/i386-pc-solaris2.10/3.4.3/specs
Configured with: /builds/sfw10-gate/usr/src/cmd/gcc/gcc-3.4.3/configure --prefix=/usr/sfw --with-as=/usr/sfw/bin/gas --with-gnu-as --with-ld=/usr/ccs/bin/ld --without-gnu-ld --enable-languages=c,c++ --enable-shared
Thread model: posix
gcc version 3.4.3 (csl-sol210-3_4-branch+sol_rpath)

Version 3.4.6 was listed as a requirement, but I thought version 3.4.3 would likely suffice.

Another requirement listed for rdesktop 1.5.0 was openssl-0.9.8f. I checked the version of OpenSSL on the system with openssl version. OpenSSL 0.9.7d was already on the system.

# /usr/sfw/bin/openssl version
OpenSSL 0.9.7d 17 Mar 2004 (+ security patches to 2006-09-29)

After installing rdesktop 1.5.0, I checked to see if it would run with the exiting 0.9.7d version of OpenSSL, but I received an error message when I attempted to run it.

# /usr/local/bin/rdesktop -0 gna.insursol.com
ld.so.1: rdesktop: fatal: libcrypto.so.0.9.8: open failed: No such file or directory
Killed

I checked to see what OpenSSL package was already on the system and saw the following:

# pkginfo | grep -i openssl
system      SUNWopenssl-commands             OpenSSL Commands (Usr)
system      SUNWopenssl-include              OpenSSL Header Files
system      SUNWopenssl-libraries            OpenSSL Libraries (Usr)
system      SUNWopenssl-man                  OpenSSL Manual Pages
system      SUNWopensslr                     OpenSSL (Root)

I checked for further information on the SUNWopenssl-commands package and saw the following:

# pkginfo -l SUNWopenssl-commands
   PKGINST:  SUNWopenssl-commands
      NAME:  OpenSSL Commands (Usr)
  CATEGORY:  system
      ARCH:  i386
   VERSION:  11.10.0,REV=2005.01.21.16.34
   BASEDIR:  /
    VENDOR:  Sun Microsystems, Inc.
      DESC:  OpenSSL Commands (Use)
    PSTAMP:  on10-patch-x20061222002936
  INSTDATE:  Feb 03 2008 21:00
   HOTLINE:  Please contact your local service provider
    STATUS:  completely installed
     FILES:        5 installed pathnames
                   3 shared pathnames
                   3 directories
                   2 executables
                 634 blocks used (approx)

I decided to download and install the OpenSSL 0.9.8f package from Sunfreeware.com.

# gunzip openssl-0.9.8f-sol10-x86-local.gz
# pkgadd -d ./openssl-0.9.8f-sol10-x86-local

But, when I attempted to run the new version, which is installed in /usr/local/ssl, I received an error message.

# /usr/local/ssl/bin/openssl version
ld.so.1: openssl: fatal: libgcc_s.so.1: open failed: No such file or directory
Killed

I checked to see what versions of libgcc_s.so were installed on the system and where they were located.

# find / -name libgcc_s.so\*
/usr/sfw/lib/amd64/libgcc_s.so.1
/usr/sfw/lib/libgcc_s.so
/usr/sfw/lib/libgcc_s.so.1

Since libgcc_s.so was located in /usr/sfw/lib, I then set LD_LIBRARY_PATH to point to that directory. I was then able to successfully run the version of openssl in /usr/local/ssl/bin .

# LD_LIBRARY_PATH=/usr/sfw/lib
# export LD_LIBRARY_PATH
# /usr/local/ssl/bin/openssl version
OpenSSL 0.9.8f 11 Oct 2007

I was then able to use rdesktop on the Solaris 10 system to log into a Windows Small Business Server (SBS) 2003 system as the administrator.

# /usr/local/bin/rdesktop -0 u administrator a.example.com

Note: if you use the above method of setting LD_LIBRARY_PATH and exporting it to run rdesktop, you will need to do so each time you open a new terminal window.

[/os/unix/solaris] permanent link

fping

I needed to determine the IP addresses of all the hosts on a LAN from a Solaris 10 system. I knew that all of them will respond to pings. To do so, I used fping. The fping program will allow you to quickly ping a range of hosts.

fping (Maintained by Thomas Dzubin)

fping is a ping(1) like program which uses the Internet Control Message Protocol (ICMP) echo request to determine if a host is up. fping is different from ping in that you can specify any number of hosts on the command line, or specify a file containing the lists of hosts to ping. Instead of trying one host until it timeouts or replies, fping will send out a ping packet and move on to the next host in a round-robin fashion. If a host replies, it is noted and removed from the list of hosts to check. If a host does not respond within a certain time limit and/or retry limit it will be considered unreachable.

Unlike ping, fping is meant to be used in scripts and its output is easy to parse.

I downloaded the Intel architecture version of fping for Solaris 10 from Sunfreeware.com and installed it.

# gunzip fping-2.4b2-sol10-intel-local.gz
# pkgadd -d ./fping-2.4b2-sol10-intel-local

The following packages are available:
  1  SMCfping     fping
                  (intel) 2.4b2

Select package(s) you wish to process (or 'all' to process
all packages). (default: all) [?,??,q]: 1

Processing package instance  from 

fping(intel) 2.4b2
ZeroHype Technologies Inc.
Using  as the package base directory.
## Processing package information.
## Processing system information.
   3 package pathnames are already properly installed.
## Verifying disk space requirements.
## Checking for conflicts with packages already installed.
## Checking for setuid/setgid programs.

Installing fping as 

## Installing part 1 of 1.
/usr/local/doc/fping/COPYING
/usr/local/doc/fping/ChangeLog
/usr/local/doc/fping/INSTALL
/usr/local/doc/fping/README
/usr/local/man/man8/fping.8
/usr/local/sbin/fping
[ verifying class  ]

Installation of  was successful.

Program usage information is shown below:

# /usr/local/sbin/fping -h

Usage: /usr/local/sbin/fping [options] [targets...]
   -a         show targets that are alive
   -A         show targets by address
   -b n       amount of ping data to send, in bytes (default 56)
   -B f       set exponential backoff factor to f
   -c n       count of pings to send to each target (default 1)
   -C n       same as -c, report results in verbose format
   -e         show elapsed time on return packets
   -f file    read list of targets from a file ( - means stdin) (only if no -g specified)
   -g         generate target list (only if no -f specified)
                (specify the start and end IP in the target list, or supply a IP netmask)
                (ex. /usr/local/sbin/fping -g 192.168.1.0 192.168.1.255 or /usr/local/sbin/fping -g 192.168.1.0/24)
   -i n       interval between sending ping packets (in millisec) (default 25)
   -l         loop sending pings forever
   -m         ping multiple interfaces on target host
   -n         show targets by name (-d is equivalent)
   -p n       interval between ping packets to one target (in millisec)
                (in looping and counting modes, default 1000)
   -q         quiet (don't show per-target/per-ping results)
   -Q n       same as -q, but show summary every n seconds
   -r n       number of retries (default 3)
   -s         print final stats
   -t n       individual target initial timeout (in millisec) (default 500)
   -u         show targets that are unreachable
   -v         show version
   targets    list of targets to check (if no -f specified)

If I wanted to determine what hosts in the 192.168.1.0 to 192.168.1.255 range exist and can be pinged, I could use the command fping -g 192.168.1.0 192.168.1.255.

# /usr/local/sbin/fping -g 192.168.1.0 192.168.1.255
192.168.1.0 is alive [<- 192.168.1.44]
192.168.1.1 is alive
192.168.1.6 is alive
192.168.1.7 is alive
192.168.1.33 is alive
192.168.1.44 is alive
192.168.1.255 is alive [<- 192.168.1.44]
192.168.1.2 is unreachable
192.168.1.3 is unreachable
192.168.1.4 is unreachable
192.168.1.5 is unreachable
192.168.1.8 is unreachable
192.168.1.9 is unreachable
192.168.1.10 is unreachable
<text snipped>
192.168.1.30 is unreachable
192.168.1.31 is unreachable
192.168.1.32 is unreachable
192.168.1.34 is unreachable
192.168.1.35 is unreachable
<text snipped>
192.168.1.40 is unreachable
192.168.1.41 is unreachable
192.168.1.42 is unreachable
192.168.1.43 is unreachable
192.168.1.45 is unreachable
<text snipped>
192.168.1.252 is unreachable
192.168.1.253 is unreachable
192.168.1.254 is unreachable

If I don't want anything displayed for IP addresses where there was no response, I could use fping -a -g <start address> <end address>, as in the example below.

# /usr/local/sbin/fping -a -g 192.168.1.0 192.168.1.255
192.168.1.0 [<- 192.168.1.44]
192.168.1.1
192.168.1.5
192.168.1.7
192.168.1.37
192.168.1.44
192.168.1.255 [<- 192.168.1.44]

The 192.168.1.0 and 192.168.1.255 addresses are network and broadcast addresses respectively, not hosts responding to ping packets. The 192.168.1.44 address is the address of the system from which I ran the ping command.

[/os/unix/solaris] permanent link

Solaris Release Number

If you need to know the release number for Solaris 10 on a system, then you can check /etc/release. You will see something like the following there:

                        Solaris 10 6/06 s10x_u2wos_09a X86
           Copyright 2006 Sun Microsystems, Inc.  All Rights Reserved.
                        Use is subject to license terms.
                             Assembled 09 June 2006

At this time, the current marketing release is Solaris 10 8/07.

[/os/unix/solaris] permanent link

Symantec AntiVirus VBN Files

The qextract.exe utility can be used to extract quarantined files from the VBN files Symantec AntiVirus Corporate Edition 8.0 and 8.1 (and possibly other versions) creates when it quarantines infected files.

[ More Info ]

[/security/antivirus/symantec] permanent link

F-Secure Rescue CD 2.00

I've been using an AVG Rescue CD to boot Windows systems from a CD, rather than the copy of Windows installed on the system's hard drive, and then perform an antivirus scan of the system. The AVG Rescue CD provides a Windows GUI for performing scans and I've found it works very well. The cost is currently $149.95 in U.S. dollars.

Searching for other rescue CD's, I also found one from F-Secure, which uses a Knoppix LiveCD to boot a system to perform an antivirus scan of the system. You can use it to boot a Windows system to check the system for viruses without booting into a possibly infected copy of the Windows operating system. F-Secure Rescue CD 2.00 is free and can update itself over the network, if a DHCP server is available on the network to provide it with IP configuration information. You don't need to understand Linux to use the software; you are presented with prompts to walk you through the process of scanning a system.

[ More Info ]

[/security/antivirus/f-secure] permanent link

Pins 4 and 5 in RJ-45 Cabling

I put a connector on an unterminated RJ-45 cable to connect a new system to a LAN. I used the T568B standard (see Twisted Pair Connectors for an explanation of the differences between T568A and T568B) for the order of the pins in the connector. I use a ByteBrothers TVR10/100 for cable testing. I plugged the end of the cable onto which I had just placed a connector into the remote unit and plugged the main unit into the patch panel at the other end of the able using one of the cables that came with the TVR10/100 test devices. The remote unit showed all 4 pairs were ok, but at the remote unit, as the LEDs cycled green, I saw that the 4,5 pair was skipped. I disconnected the remote unit and found that the 4,5 LED was still lit on the main unit, which was odd.

I double-checked the connector I had put on the cable; it looked fine. I punched down the end at the patch panel again without pulling the cable out of the punchdown block, but the problem remained. I then wondered whether I really needed pins 4 and 5 working for a 10 Mbs or 100 Mbs Ethernet connection. Turns out I didn't. I ran a patch cable from the port on the patch panel to the network switch and plugged the other end of the cable into my laptop; the network connection worked.

The manual for the TVR10/100 LAN Tester provides the following information on the cable pairs required for 10 Mbs and 100 Mbs Ethernet connections.

If a cable problem disables data communications at 100 MB/s.
The problem could be caused by not enough connected pairs: 10Base-T data communications only requires two pair cables. There are two 100Base-T standards, one requires two pair cables and the other requires four wire pair cables. If a two pair cable is used, when four pair cables is required, a slow 10 MB/s connection will be permanently established. The cable problem could be caused by inverted pairs. A pair exists, but the pins are inverted (e.g. 1,2 is 2,1). Or the problem could be the cabling is not rated for 100 MB/s speeds ("category 5" cable).

LAN Type	Cable Pairs Required
10Base-T	1,2	3,6
100Base-T (Type 1 or TX)	1,2	3,6
100Base-T (Type 2 or T4)	1,2	3,6	4,5	7,8

As shown in the above table, 10Base-T or 100Base-T (Type 1 or TX) LAN ports use two pair cables. 100Base-T (Type 2 or T4) LANs require all four pairs. It is best to use and install Category 5 cables with all four pairs to ensure compatibility with all three types of Base-T LANs.

If there is a short or open on pairs 1, 2 and 3,6 all communications will be prevented. If there is a short or open on pairs 4,5 or 7,8 the data rate may drop to 10 MB/s.

A faulty cable with missing or faulty pairs 4,5 or 7,8 may cause the data rate on that cable to drop to 10 MB/s If this faulty cable is between a PC and hub, all data going to and from that single PC will be at a slow rate. If the faulty cable is between two hubs then communications will some times be quick and other times it will be slow. Communications between PC connected to the same hub will be quick. Communications betwen a PC on one hub across a faulty cable to a PC on another hub will be slow. This type of problem can be very difficult to find without a TVR10/100.

So, I should probably fix the problem when I have time, even though the cable provides network connectivity at the moment.

There is a clear explanation of how to build an RJ-45 Ethernet cable at Building a RJ-45 Ethernet cable of a specific length (light version) . A source explaining the difference between 568A and 568B standards is Twisted Pair Connectors. How to wire Ethernet Cables is another good reference for Ethernet cables.

[/network/cabling] permanent link